We use these terms a lot and we also use phrases which mean things similar to these terms.  I’d like to explicitly define them and I encourage all to use them as defined so as to be clear and concise.  I think it will help.

 

·         Authentication = based on the credentials you have shared (e.g. user name, password, SMS response, smart card, etc.), we know who you are

·         Authorization = based on who you are, you are allowed to access specific resources and those resources only, i.e. we define what you can do

 

If you want to be extra-nerdy:

 

·         Authentication can be abbreviated “authN”

·         Authorization can be abbreviated “authZ”

·         Authentication and Authorization together can be referenced as “authX”

 

I hope that’s useful.

 

/marksv

_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg